Skip to content

Commit 49b8be4

Browse files
developerkunaldeveloperkunal
authored
Add RL-Secure workflow for scanning build artifacts (#634)
### Changes Please describe both what is changing and why this is important. Include: - Endpoints added, deleted, deprecated, or changed - Classes and methods added, deleted, deprecated, or changed - Screenshots of new or changed UI, if applicable - A summary of usage if this is a new feature or change to a public API (this should also be added to relevant documentation once released) - Any alternative designs or approaches considered ### References Please include relevant links supporting this change such as a: - support ticket - community post - StackOverflow post - support forum thread ### Testing Please describe how this can be tested by reviewers. Be specific about anything not tested and reasons why. If this library has unit and/or integration testing, tests should be added for new functionality and existing tests should complete without errors. - [ ] This change adds unit test coverage - [ ] This change adds integration test coverage - [ ] This change has been tested on the latest version of the platform/language or why not ### Checklist - [ ] I have read the [Auth0 general contribution guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md) - [ ] I have read the [Auth0 Code of Conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md) - [ ] All existing and new tests complete without errors
1 parent 94c7e3d commit 49b8be4

File tree

3 files changed

+170
-1
lines changed

3 files changed

+170
-1
lines changed

‎.github/actions/rl-scanner/action.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: "Reversing Labs Scanner"
2+
description: "Runs the Reversing Labs scanner on a specified artifact."
3+
inputs:
4+
artifact-path:
5+
description: "Path to the artifact to be scanned."
6+
required: true
7+
version:
8+
description: "Version of the artifact."
9+
required: true
10+
11+
runs:
12+
using: "composite"
13+
steps:
14+
- name: Set up Python
15+
uses: actions/setup-python@v4
16+
with:
17+
python-version: "3.10"
18+
19+
- name: Install Python dependencies
20+
shell: bash
21+
run: |
22+
pip install boto3 requests
23+
24+
- name: Configure AWS credentials
25+
uses: aws-actions/configure-aws-credentials@v1
26+
with:
27+
role-to-assume: ${{ env.PRODSEC_TOOLS_ARN }}
28+
aws-region: us-east-1
29+
mask-aws-account-id: true
30+
31+
- name: Install RL Wrapper
32+
shell: bash
33+
run: |
34+
pip install rl-wrapper>=1.0.0 --index-url "https://${{ env.PRODSEC_TOOLS_USER }}:${{ env.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
35+
36+
- name: Run RL Scanner
37+
shell: bash
38+
env:
39+
RLSECURE_LICENSE: ${{ env.RLSECURE_LICENSE }}
40+
RLSECURE_SITE_KEY: ${{ env.RLSECURE_SITE_KEY }}
41+
SIGNAL_HANDLER_TOKEN: ${{ env.SIGNAL_HANDLER_TOKEN }}
42+
PYTHONUNBUFFERED: 1
43+
run: |
44+
if [ ! -f "${{ inputs.artifact-path }}" ]; then
45+
echo "Artifact not found: ${{ inputs.artifact-path }}"
46+
exit 1
47+
fi
48+
49+
rl-wrapper \
50+
--artifact "${{ inputs.artifact-path }}" \
51+
--name "${{ github.event.repository.name }}" \
52+
--version "${{ inputs.version }}" \
53+
--repository "${{ github.repository }}" \
54+
--commit "${{ github.sha }}" \
55+
--build-env "github_actions" \
56+
--suppress_output
57+
58+
# Check the outcome of the scanner
59+
if [ $? -ne 0 ]; then
60+
echo "RL Scanner failed."
61+
echo "scan-status=failed" >> $GITHUB_ENV
62+
exit 1
63+
else
64+
echo "RL Scanner passed."
65+
echo "scan-status=success" >> $GITHUB_ENV
66+
fi
67+
68+
outputs:
69+
scan-status:
70+
description: "The outcome of the scan process."
71+
value: ${{ env.scan-status }}

‎.github/workflows/publish.yml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,23 @@ permissions:
1111
id-token: write # Required for trusted publishing to PyPI
1212

1313
jobs:
14+
rl-scanner:
15+
uses: ./.github/workflows/rl-scanner.yml
16+
with:
17+
node-version: 18
18+
artifact-name: "auth0-python.tgz"
19+
secrets:
20+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
21+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
22+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
23+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
24+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
25+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
1426
publish-pypi:
1527
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
1628
name: "PyPI"
1729
runs-on: ubuntu-latest
30+
needs: rl-scanner
1831
environment: release
1932

2033
steps:
@@ -23,7 +36,7 @@ jobs:
2336
with:
2437
fetch-depth: 0
2538
fetch-tags: true
26-
39+
2740
# Get the version from the branch name
2841
- id: get_version
2942
uses: ./.github/actions/get-version

‎.github/workflows/rl-scanner.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
name: RL-Secure Workflow
2+
name: RL-Secure Workflow
3+
4+
on:
5+
workflow_call:
6+
inputs:
7+
python-version:
8+
required: true
9+
type: string
10+
artifact-name:
11+
required: true
12+
type: string
13+
secrets:
14+
RLSECURE_LICENSE:
15+
required: true
16+
RLSECURE_SITE_KEY:
17+
required: true
18+
SIGNAL_HANDLER_TOKEN:
19+
required: true
20+
PRODSEC_TOOLS_USER:
21+
required: true
22+
PRODSEC_TOOLS_TOKEN:
23+
required: true
24+
PRODSEC_TOOLS_ARN:
25+
required: true
26+
27+
jobs:
28+
checkout-build-scan-only:
29+
runs-on: ubuntu-latest
30+
31+
permissions:
32+
pull-requests: write
33+
id-token: write
34+
35+
steps:
36+
- uses: actions/checkout@v4
37+
with:
38+
fetch-depth: 0
39+
fetch-tags: true
40+
41+
- name: Configure Python
42+
uses: actions/setup-python@v5
43+
with:
44+
python-version: ${{ inputs.python-version }}
45+
46+
- name: Configure dependencies
47+
run: |
48+
pip install --user --upgrade pip
49+
pip install --user pipx
50+
pipx ensurepath
51+
pipx install poetry==1.4.2
52+
pip install --upgrade pip
53+
pip install boto3 requests
54+
poetry config virtualenvs.in-project true
55+
poetry install --with dev
56+
poetry self add "poetry-dynamic-versioning[plugin]==1.1.1"
57+
58+
- name: Build release
59+
run: |
60+
poetry build
61+
62+
- name: Create tgz build artifact
63+
run: |
64+
tar -czvf ${{ inputs.artifact-name }} *
65+
66+
- name: Get Artifact Version
67+
id: get_version
68+
run: echo "version=$(cat .version)" >> $GITHUB_ENV
69+
70+
- name: Run RL Scanner
71+
id: rl-scan-conclusion
72+
uses: ./.github/actions/rl-scanner
73+
with:
74+
artifact-path: "$(pwd)/${{ inputs.artifact-name }}"
75+
version: "${{ steps.get_version.outputs.version }}"
76+
env:
77+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
78+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
79+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
80+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
81+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
82+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
83+
84+
- name: Output scan result
85+
run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV

0 commit comments

Comments
 (0)